oauth1/access endpoint is returning the Wordpress site index on 4.9

[kfreezen]

All the other steps in the tutorials work for me (oauth1/request, oauth1/authorize) but when I try to get a permanent access token, all I get back is an HTML response with 200 OK.

If I'm missing an oauth parameter then I get an error as expected, but if everything in my request is correct, I get back the index page rather than an application/x-www-form-urlencoded list like expected.